GitHub Advisoryadvisory · Packagist

GHSA-ch3r-vp46-8g22 Code injection in topthink/think

CRITICAL Published 2021-08-09 Modified 2021-08-31 Official page ↗
Aliases
CVE-2020-17952
Ecosystem
Packagist
Packages
topthink/think
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2021-08-02

Affected packages

• Packagist topthink/think: <= 6.0.9 (no fix yet)

Description

A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.

Related

Alias · CVE (1)

  • CVE-2020-17952 A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References